FCA April 2026 CDD and EDD Review: Periodic and Event-Driven Reviews
What the FCA's April 2026 review of customer due diligence, enhanced due diligence and ongoing monitoring found, and how accountancy firms can use it to set review cycles and triggers.
On 8 April 2026 the Financial Conduct Authority (FCA) published the findings of its latest review of how firms carry out customer due diligence (CDD), enhanced due diligence (EDD) and ongoing monitoring. The review is aimed at FCA-supervised firms, so accountancy practices supervised by HMRC or a professional body are not directly bound by it. It is still one of the clearest recent statements of what a regulator regards as good and poor practice, and supervisors of accountants tend to look for the same things. This guide pulls out the lessons that matter most for a practice, with a focus on periodic reviews and event-driven reviews.
What the FCA set out to do
According to law firm Stephenson Harwood's summary of the publication, the FCA's stated aim was to raise standards and share practical insights. The findings are written as examples of good practice and poor practice rather than new rules, so they are best used as a benchmark for your own controls. If you want the foundations first, our guide to KYC and customer due diligence for accountancy practices covers the basics.
Good practice the FCA highlighted
Reported examples of stronger firms included the following.
- Policies that clearly separate EDD from standard CDD and explain which measures apply to each, using a risk-based approach.
- Detailed control frameworks for identifying politically exposed persons (PEPs).
- EDD stages that are documented, with clear governance and senior management sign-off for specified scenarios or customer types, for example through a compliance committee.
- Independent third-line testing of onboarding and due diligence controls, with documented findings that are acted on. Thematic reviews by external parties or internal audit were also treated as good practice.
Poor practice the FCA highlighted
The weaknesses reported were just as instructive.
- Staff guidance that said too little about verifying identity, particularly where a customer cannot provide standard identification and alternative evidence is needed.
- EDD policies that did not explain what additional measures to apply.
- Failure to gather or record the purpose and intended nature of the business relationship.
- No defined review cycles or periodic reviews, and unclear triggers for event-driven reviews.
- No independent second-line assurance, with the same staff handling both onboarding and reviews, which raises doubts about how impartial the testing is.
- Little detail on quality control and no version control, leaving firms unable to show an audit trail of reviews or changes.
Periodic reviews versus event-driven reviews
Stephenson Harwood attributes the FCA's expectations on ongoing monitoring to the FCA's Nationwide Final Notice of December 2025. In short, there are two kinds of review. A periodic review takes place at intervals set by the customer's risk assessment, so a higher-risk client is revisited more often than a lower-risk one. An event-driven review happens outside that schedule when something changes the customer's risk. Each firm has to decide which events should trigger a review.
For an accountancy practice, the same logic is straightforward to apply. The detailed mechanics of scheduling are covered in our guide to ongoing monitoring and periodic CDD review. The table below shows one way to frame the two types. These are examples to adapt, not a regulatory list.
| Type of review | What starts it | Example for a practice |
|---|---|---|
| Periodic | The review date set by the client's risk rating | Higher-risk clients reviewed annually, lower-risk clients on a longer cycle that you have documented and can justify |
| Event-driven | A change that affects risk | A change of ownership or control, a new high-risk jurisdiction in the structure, a client becoming a PEP, adverse media, or an unexplained change in activity |
Turning the findings into practice controls
You do not need a bank-sized compliance function to act on these points. A sensible approach for a practice is to work through the following steps.
- Write down your review cycles. Link each client risk rating to a review interval, and make sure the rating itself comes from a consistent method. Our guide to client risk rating, acceptance and exit explains how.
- List your event triggers. Decide in advance which changes force a fresh look at the client, and who is responsible for noticing them. Triggers that nobody owns tend not to fire.
- Record the purpose of the relationship. The FCA treated missing information on the purpose and intended nature of the relationship as poor practice, and the point carries straight over to engagement letters and onboarding forms.
- Spell out your EDD measures. State what extra steps apply to higher-risk clients, such as additional source of funds or source of wealth evidence and senior sign-off, rather than just saying that EDD is required.
- Give staff an alternative-evidence process. Clients without standard identification do exist. Having a documented route avoids ad hoc decisions.
- Separate doing from checking. In a small firm full independence may be impossible, but a second person, or an external reviewer, can test a sample of files.
- Keep an audit trail. Version your policies and keep dated evidence of each review, including what changed and who approved it.
The FCA's related review of firms in a different part of the market makes similar points about methodology and documentation. Our summary of the FCA review of asset management and private markets AML controls is a useful companion.
Frequently asked questions
Does the FCA review apply to accountancy firms?
It is directed at FCA-supervised firms. Most accountancy practices are supervised by HMRC or a professional body for anti-money laundering purposes, so the review does not bind them directly. It is nonetheless a strong indicator of supervisory expectations and a reasonable benchmark.
How often should a periodic review take place?
The review described in the sources links frequency to the customer's risk assessment rather than setting a single interval. Your firm decides the cycle for each risk band and should be able to explain why.
What counts as a trigger for an event-driven review?
Each firm decides. Typical candidates are changes in ownership or control, new jurisdictions, a client becoming a PEP, adverse media and unusual activity. What matters is that the triggers are defined, communicated and acted on.
What is the biggest documentation gap?
The review highlighted missing review cycles, unclear triggers and weak audit trails. If you can show a dated, approved record for every review, you are ahead of the poor practice examples.
Next steps
Take your current CDD, EDD and monitoring procedures and compare them line by line with the good and poor practice examples above. Fix the gaps in review cycles, triggers and records first, because those were the clearest weaknesses. If your team needs structured training to back this up, explore Learnsignal's CPD courses for finance and compliance professionals. Always check the FCA's own publication and your supervisor's guidance for the exact wording of any requirement.
This page was last updated:
Learnsignal Education Team
Expert Tutor at Learnsignal
Qualified professional with years of experience helping students advance their professional careers.
View all posts by Learnsignal Education Team